extraction Archives

Winsage

August 26, 2025

5 “just-enough” open-source apps I install on every fresh Windows setup

A fresh installation of Windows provides a clean slate, but soon requires essential tools for tasks like file extraction, text editing, audio recording, and screen capturing. The following open-source tools are recommended: - 7-Zip: A lightweight file compression tool that supports various formats (.zip, .rar, .tar, .7z, .iso) and integrates into the right-click context menu. It is free and maintained by a community. - OBS Studio: An open-source software for gamers and content creators that excels in livestreaming and game recording, featuring customizable recording parameters and a replay buffer. - Audacity: A long-standing open-source audio editing software that is lightweight yet feature-rich, ideal for straightforward audio editing tasks and supports built-in effects and plugins. - Notepad++: An enhanced text editor that supports multiple programming languages and syntax highlighting, making it suitable for editing configuration files, with lightweight nature and plugin support. - ShareX: An open-source screenshot tool that offers advanced features and customizable workflows, improving upon the Snipping Tool for seamless screenshot management. The author values these tools for being free, open-source, and reliable, often preferring them over proprietary software.

AppWizard

August 24, 2025

The new game from Painkiller and Bulletstorm’s creators is a tropical survival shooter that looks a teensy bit like Far Cry, and it’s out in early access next month

Lost Rift is a survival game developed by People Can Fly, set in a tropical archipelago called Pioneer's Landing. It features cooperative gameplay and a PvP extraction mode where players can explore unstable islands for loot while competing against others. The game is set to launch in Steam early access on September 25th, offering at least 10 hours of PvE content alongside multiplayer expeditions. The studio has faced recent challenges, including layoffs and project reductions, making the success of Lost Rift important for its future.

AppWizard

August 23, 2025

Free Steam Game a Huge Hit With Over 200,000 Concurrent Players

A free-to-play game on Steam, Delta Force, recently achieved 201,930 concurrent players, ranking 78th on the all-time Steam concurrent players chart. Launched in December 2024, it has garnered 54,743 user reviews with a 65 percent approval rating, despite a "Mixed" rating due to issues with cheating and hacking. The game features three modes, including large-scale 32v32 combat, and incorporates microtransactions without a pay-to-win model. It currently does not support the Steam Deck.

AppWizard

August 11, 2025

This week in PC games: deep-sea roguelite raids, first-person horror cookery, and a spruced-up Dawn of War

Edwin is on a brief hiatus and prefers to be addressed as "Dr. Edwin" during meetings. He expects others to turn off their cameras and mute themselves if they forget. This week’s overview of new PC game releases includes: - Nebelmer: A compact open-world explorer that won Best Student Game at the Belgian Game Awards. - Echoes of the End: A narrative-rich fantasy hack-and-slash game inspired by Iceland's landscapes. - Abyssus: A 4-player roguelike co-op shooter set in sunken temples. - Dungeon Stalkers: An early access "extraction PvPvE dungeon crawler" with puzzling elements. - Alchemy of the Earth: A game where players mix potions to fend off skeletons. - Stomach: A survival horror cooking game set on an abandoned cruise ship. This week is quiet due to Edwin and Nic being on leave, while Mark plays Mafia: The Old Country. Gamescom is approaching.

AppWizard

August 6, 2025

I thought it was a cute and casual little mining sim right up until it devoured my entire morning

Players in Gemporium: A Cute Mining Sim take on the role of a mole who inherits a gem shop and a debt of one million dollars. The game features mining mechanics with tools like a television for tracking sought-after gemstones and a magnifying glass for finding gems at dig sites. Players can upgrade their abilities to double gem extraction and use haggling mechanics to negotiate better sales. The game includes a humorous element of owing a loan shark, who is literally a shark. A free demo is available, and the full game will launch on Steam on August 7.

Tech Optimizer

July 28, 2025

Renting Android Malware With 2FA Interception, AV Bypass is Getting Cheaper Now

The cybercriminal landscape is experiencing a transformation with the emergence of malware-as-a-service (MaaS) platforms targeting Android devices, allowing individuals with minimal technical skills to deploy advanced mobile threats through accessible subscription-based malware kits. Notable platforms include PhantomOS, priced at 9 monthly, offering features like remote application installation and two-factor authentication bypass, and Nebula, starting at 0 monthly, which provides automated data extraction of SMS, call logs, and GPS data. Both platforms utilize Telegram for command and control, enabling easy management of infected devices. These MaaS platforms employ advanced evasion techniques, utilizing fully undetectable malware that can bypass major security measures, ensuring persistence and compatibility with various Android versions, including the latest Android 15. This shift signifies a move toward industrialized cybercrime, where specialized providers handle technical complexities, allowing criminals to focus on targeting victims.

AppWizard

July 25, 2025

Fake Indian Banking Apps on Android Steal Login Credentials from Users

A recently discovered malicious Android application poses significant risks by masquerading as legitimate banking apps in India. It facilitates credential theft, conducts surveillance, and executes unauthorized financial transactions. The malware operates on a modular architecture with a dropper and primary payload, employing deceptive user interfaces and silent installation techniques to evade detection. The dropper requests extensive permissions, including ACCESSNETWORKSTATE, REQUESTINSTALLPACKAGES, and QUERYALLPACKAGES, to monitor connectivity, install secondary APKs without user awareness, and profile installed apps. It loads a hidden payload and initiates installation using an INSTALL_NOW flag, bypassing app store scrutiny. The main payload requests additional permissions such as READSMS, SENDSMS, and RECEIVESMS for intercepting one-time passwords (OTPs) and two-factor authentication (2FA) codes. It also requests REQUESTIGNOREBATTERYOPTIMIZATIONS, READPHONESTATE, and READPHONENUMBERS for uninterrupted execution, device fingerprinting, and potential call forwarding abuse. Data exfiltration occurs through Firebase Realtime Database, storing user IDs and intercepted SMS metadata. The malware uses Firebase for command-and-control operations and generates phishing pages resembling authentic banking interfaces. Delivery methods include smishing, email phishing, WhatsApp bots, vishing calls, SEO-poisoned websites, malvertising, Trojanized utilities, QR/NFC attacks, preloaded malware on counterfeit devices, and exploitation of accessibility service vulnerabilities. Indicators of compromise include specific SHA256 hashes for the base payload and main payload.

Winsage

July 24, 2025

Update for Windows 11 brings more resilience (and Recall)

The optional update KB5062660 for Windows 11 version 24H2 introduces several new features, including Microsoft Recall in Europe, which allows users to export snapshots of their activities with a unique export code for privacy. The Click to Do functionality expands with a new Practice in Reading Coach feature and integration with Microsoft Teams for drafting messages. An AI agent is added to the settings app for Copilot+ PCs, while non-Copilot+ systems have a centered search bar for accessibility. The update includes rapid machine recovery options, enhancements to the Start menu, improved snap functionality, and a new Gamepad keyboard layout for gamers. It also resolves various issues from previous versions, including bugs in File Explorer and system stability problems. AI components related to Image Search, Content Extraction, and Semantic Analysis have been enhanced, and there are no known issues with this update. Features will be rolled out gradually to users.

Winsage

July 17, 2025

Windows Server 2025 Golden dMSA Attack Enables Authentication Bypass and Password Generation

A design flaw in Microsoft’s Windows Server 2025, known as “Golden dMSA,” allows attackers to bypass authentication and generate passwords for all managed service accounts across enterprise networks. This vulnerability exploits a weakness in delegated Managed Service Accounts (dMSAs), reducing cryptographic protections to a brute-force attack requiring only 1,024 attempts. Discovered by Semperis Security Researcher Adi Malyanker, the attack involves extracting cryptographic material from the Key Distribution Services (KDS) root key, enumerating dMSA accounts, guessing ManagedPasswordId attributes, and generating passwords. The KDS root keys do not expire, potentially granting indefinite access. The vulnerability is classified as moderate risk, requiring possession of a KDS root key, accessible only to privileged accounts. Detection of the attack is challenging, as no security events are logged by default when KDS root keys are compromised. Microsoft acknowledged the vulnerability on May 27, 2025, and stated that the features were not intended to protect against domain controller compromises.

AppWizard

July 16, 2025

Konfety Android Malware Exploits ZIP Tricks to Masquerade as Legit Apps on Google Play

Security researchers from zLabs have identified a new version of the Konfety Android malware that uses advanced ZIP-level modifications to avoid detection and mimic legitimate apps on the Google Play Store. The malware employs an "evil-twin" strategy, distributing malicious versions with the same package names as harmless apps. It manipulates the APK's ZIP structure to disrupt reverse engineering tools, allowing it to evade analysis. The installation process on Android can handle these malformed packages without raising alarms. Konfety features a dynamic code loading mechanism, hiding a secondary Dalvik Executable (DEX) file that is decrypted at runtime, which contains malicious components. It integrates with the CaramelAds SDK for ad fraud, while disguising its activities through geofencing and icon concealment. The malware has been linked to previous campaigns and uses decoy applications on the Play Store for camouflage. Upon execution, it redirects users to fraudulent websites, leading to unwanted app installations and compromising user privacy. The threat actors behind Konfety continuously update their tactics to evade detection, highlighting the growing sophistication of Android malware. Users are advised to scrutinize app sources and monitor network activity to mitigate risks.